DraftKings thwarts credential stuffing attack, but urges password reset and MFA

DraftKings says a credential stuffing campaign targeted its platform, with unauthorized access to a limited number of user accounts detected on 2 September 2025. The company investigated and contained the incident quickly, with no evidence that its systems or networks were breached or that sensitive data such as government-issued IDs or full financial details were accessed.

Potentially accessed data include names, addresses, dates of birth, phone numbers, email addresses, the last four digits of payment cards, profile photos, transaction details and account balances, and the dates passwords were last changed, though DraftKings reports that login credentials were likely obtained from a non-DraftKings source rather than from its own systems.

The firm urged impacted users to secure their accounts, forcibly resetting passwords and enabling multi-factor authentication for DK Horse accounts, and added new safeguards to prevent similar attacks in the future, according to the data breach notification. The article notes that in November 2022 around 68,000 accounts had previously been compromised in another credential stuffing incident, and that a US teenager pleaded guilty in January 2024 to involvement in earlier attacks.